Social engineering exploits human nature, not software flaws. One in ten phishing emails now evades standard security filters. These attacks drive the majority of costly data breaches and ransomware incidents.
Key Takeaways
- Phishing emails evade filters 1 in 10 times
- Average BEC scam costs $4.91 million to detect
- 87% of users fail to recognize phishing
- 74% of cybersecurity breaches involve the human element including social engineering
- 75% of executives targeted more likely to suffer breach
Social engineering attacks are frequent and harmful, making employee training essential to reduce real-world breaches.
Related reading
01 · Category
Common Types26 stats
01
Phishing emails evade filters 1 in 10 times
02
Vishing (voice phishing) used in 20% of attacks
03
Smishing (SMS phishing) attacks up 328% in 2022
04
Spear-phishing comprises 65% of targeted attacks
05
Business Email Compromise (BEC) is 90% social engineering
06
Pretexting used in 15% of successful breaches
07
Baiting attacks involve USB drops in 12% cases
08
Quishing (QR code phishing) rose 51% in 2023
09
Tailgating/physical access in 5% of social engineering
10
Whaling targets executives in 8% of phishing
11
Email phishing is 94% of social engineering vectors
12
BEC scams average $120,000loss per incident
13
Vishing success rate 7% higher than email phishing
14
Smishing open rates 20% vs 3% email
15
51% of phishing uses malicious attachments
16
49% use malicious links in phishing
17
Tech support scams (vishing) in 25% of calls
18
Dumpster diving in 3% physical social engineering
19
Watering hole attacks combined with social eng 10%
20
70% of ransomware starts with phishing
21
Fake websites in 80% of phishing campaigns
22
Multi-channel attacks (email+SMS) 15%
23
Impersonation of brands in 92% phishing
24
CEO fraud (whaling) 14% of BEC
25
Shoulder surfing in 4% incidents
26
40% phishing exploits current events
Interpretation
Common Types Interpretation
The grim truth is that while email remains the con artist’s favorite workbench, this buffet of threats—from vishing’s persuasive calls to smishing’s explosive growth and quishing’s quiet rise—proves our collective human curiosity is now the most exploited vulnerability in the world.
02 · Category
Financial and Economic Impact25 stats
01
Average BEC scam costs $4.91 million to detect
02
Phishing causes $4.91 billion annual losses
03
Global cost of cybercrime $8 trillion, 50% social eng related
04
Average data breach cost $4.45 million, social eng primary
05
BEC losses $2.7 billion in 2022
06
Phishing costs SMEs $25,000per incident
07
Ransomware via phishing averages $1.85 million
08
60% of breaches cost over $1 million, human error
09
Tech support scams $575 million losses 2022
10
Average phishing training ROI 14x, implying high costs
11
Social engineering breach downtime 23 days average
12
$9.44 million average megabreach cost
13
Phishing responsible for 90% of breaches costing $3.9M
14
BEC median loss $50,000per victim
15
Cybercrime losses $10.3 billion reported to FBI 2022
16
Email fraud losses $12.5 billion globally 2022
17
SME breach cost $3.31 million average
18
Notification costs $0.28per record post-breach
19
Lost business post-social eng breach 31%
20
Incident response costs $1.94 million average
21
Exfiltration costs $5.09 million
22
Personal data theft via phishing $42per record
23
50% of orgs paid ransom after phishing ransomware
24
Average ransom $1.54 million
25
Downtime costs $1.85 million for ransomware
Interpretation
Financial and Economic Impact Interpretation
If the multi-trillion-dollar tax of global cybercrime has taught us anything, it’s that the most expensive line item on any budget is the assumption that your employees wouldn't click on a really convincing email about an overdue invoice.
03 · Category
Mitigation and Awareness24 stats
01
87% of users fail to recognize phishing
02
Security awareness training reduces clicks by 40%
03
MFA blocks 99.9% account compromise
04
Simulated phishing training cuts risks 90%
05
69% fewer incidents post-training
06
Email filters catch 97% of phishing
07
Awareness programs reduce human error 70%
08
92% phish-prone users after training drop to 5%
09
Reporting suspicious emails rises 50% with training
10
Zero-trust reduces social eng impact 80%
11
AI detection improves phishing catch by 30%
12
Regular simulations needed, 50% forget without
13
82% support mandatory training
14
Password managers prevent 81% credential theft
15
DMARC adoption cuts spoofing 96%
16
40% risk reduction with ongoing training
17
75% of orgs lack phishing simulations
18
Training ROI $11per $1 spent
19
65% less BEC with verification policies
20
Awareness cuts vishing success 60%
21
90% reduction in clicks after 90 days training
22
Least privilege access blocks 55% escalation
23
Employee reporting stops 19% attacks early
24
52% orgs improved post-training metrics
Interpretation
Mitigation and Awareness Interpretation
The data reveals that while humans are predictably the weakest link, with 87% initially falling for phishing, we are also the strongest defense when properly equipped, as comprehensive training and layered security measures can collectively reduce the human risk factor by over 90% and turn employees into a formidable early-warning system.
04 · Category
Prevalence and Frequency30 stats
01
74% of cybersecurity breaches involve the human element including social engineering
02
Phishing accounts for 36% of all data breaches
03
82% of breaches involved a human element in 2022
04
Social engineering was used in 19% of breaches last year
05
300,000 phishing sites are created daily
06
1 in 10 users receive phishing emails daily
07
90% of organizations experienced at least one successful phishing attack in 2022
08
Social engineering incidents rose 11% year-over-year
09
16,000 phishing attacks reported weekly
10
85% of data breaches are caused by phishing
11
Over 3.4 billion phishing emails sent daily
12
22 billion spam emails sent per day with phishing
13
96% of social engineering attacks via email
14
Phishing attacks increased by 65% in 2022
15
1.2 million phishing complaints to FTC in 2022
16
83% of UK businesses hit by phishing
17
Social engineering in 98% of attacks on businesses
18
4.71 billion email accounts targeted by phishing annually
19
1 in 99 emails is phishing
20
Phishing volume up 47% in Q1 2023
21
68% of businesses faced social engineering in 2023
22
Over 800,000 phishing sites active monthly
23
Social engineering attacks doubled since 2020
24
91% of cyberattacks start with phishing email
25
5 billion phishing emails per day globally
26
76% of organizations tested had phish-prone users
27
Phishing reports up 1500% since COVID
28
32% increase in BEC scams
29
241,000 unique phishing reports in 2022
30
60% of companies experienced phishing in past year
Interpretation
Prevalence and Frequency Interpretation
Despite our relentless pursuit of digital fortresses, the most exploited vulnerability remains, ironically, the same one that mastered the opposable thumb: the human brain, now besieged by a relentless daily flood of deceptively personal messages.
05 · Category
Victim Characteristics25 stats
01
75% of executives targeted more likely to suffer breach
02
Millennials 36% more likely to fall for phishing
03
Finance sector 24% of phishing targets
04
Healthcare 18% of breaches via social eng
05
SMEs 43% more vulnerable to phishing
06
95% of breaches target employees
07
Women 12% less likely to click phishing links
08
C-suite 4x more targeted by whaling
09
Remote workers 3x more susceptible
10
22-25 age group highest click rate 12.3%
11
Government sector 16% phishing victims
12
Retail 22% hit by social engineering
13
IT staff fall for phishing 40% rate
14
Non-tech employees 2.5x more likely victims
15
60% of executives bypass security training
16
US victims 70% of global phishing reports
17
Healthcare workers 25% phish-prone
18
Finance employees 15% higher click rate
19
Contractors 30% more vulnerable
20
46-55 age group 9.5% click rate
21
Education sector 28% breach rate social eng
22
Females report 20% more phishing incidents
23
New hires 50% more susceptible first month
24
Manufacturing 14% social eng targets
25
Overconfident users click 3x more
Interpretation
Victim Characteristics Interpretation
Executives can’t skip security training because the best way to a company’s secrets is still through a human, whether it’s a phish-prone new hire, an overconfident millennial, a targeted C-suite whale, or the IT guy who really should know better.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Elif Demirci. (2026, February 13). Social Engineering Attacks Statistics. Gitnux. https://gitnux.org/social-engineering-attacks-statistics
MLA
Elif Demirci. "Social Engineering Attacks Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/social-engineering-attacks-statistics.
Chicago
Elif Demirci. 2026. "Social Engineering Attacks Statistics." Gitnux. https://gitnux.org/social-engineering-attacks-statistics.
Sources & references
37 datasets cited across this report · attribution is report-level